Reduce npm deprecations and remediate npm audit vulnerabilities #53

New Issue

2026-07-29T02:37:08-07:00

westfarn commented

2026-07-29 02:37:08 -07:00

Problem

Running npm ci in chat_web_app/llm-fe reports many deprecated packages and 103 vulnerabilities (8 low, 20 moderate, 71 high, 4 critical).

This raises security risk and makes dependency maintenance harder.

Evidence

Multiple deprecated transitive dependencies (inflight, glob, rimraf, tar, svgo, eslint, several conventional-changelog-*, etc.)
npm audit summary:
- 103 vulnerabilities total
- 71 high, 4 critical

Goal

Bring dependency tree to supported package versions and reduce vulnerabilities to acceptable baseline (ideally zero critical/high).

Proposed plan

Run baseline reports:
- npm ls --depth=3
- npm audit --json > audit-before.json
Safe automatic updates:
- npm audit fix
Identify top vulnerable chains:
- Focus packages pulling old glob/rimraf/tar, old workbox, old Babel proposal plugins, old eslint, old svgo, old uuid
Upgrade direct deps and tooling:
- Prefer maintained replacements (e.g. @rollup/plugin-terser, current eslint, maintained changelog tooling)
If needed, controlled breaking updates:
- npm audit fix --force in dedicated branch, verify app/test/build
Verify and document:
- npm ci
- npm audit
- npm run build
- core smoke tests

Acceptance criteria

No critical vulnerabilities
High vulnerabilities reduced to agreed threshold (target: zero)
npm ci completes without unsupported key tooling in direct deps
Build and smoke tests pass

Notes

Some warnings are transitive and may require upgrading or replacing parent dependencies, not just direct package bumps.

## Problem Running `npm ci` in `chat_web_app/llm-fe` reports many deprecated packages and `103 vulnerabilities` (`8 low`, `20 moderate`, `71 high`, `4 critical`). This raises security risk and makes dependency maintenance harder. ## Evidence - Multiple deprecated transitive dependencies (`inflight`, `glob`, `rimraf`, `tar`, `svgo`, `eslint`, several `conventional-changelog-*`, etc.) - `npm audit` summary: - 103 vulnerabilities total - 71 high, 4 critical ## Goal Bring dependency tree to supported package versions and reduce vulnerabilities to acceptable baseline (ideally zero critical/high). ## Proposed plan 1. Run baseline reports: - `npm ls --depth=3` - `npm audit --json > audit-before.json` 2. Safe automatic updates: - `npm audit fix` 3. Identify top vulnerable chains: - Focus packages pulling old `glob/rimraf/tar`, old `workbox`, old Babel proposal plugins, old `eslint`, old `svgo`, old `uuid` 4. Upgrade direct deps and tooling: - Prefer maintained replacements (e.g. `@rollup/plugin-terser`, current `eslint`, maintained changelog tooling) 5. If needed, controlled breaking updates: - `npm audit fix --force` in dedicated branch, verify app/test/build 6. Verify and document: - `npm ci` - `npm audit` - `npm run build` - core smoke tests ## Acceptance criteria - No critical vulnerabilities - High vulnerabilities reduced to agreed threshold (target: zero) - `npm ci` completes without unsupported key tooling in direct deps - Build and smoke tests pass ## Notes Some warnings are transitive and may require upgrading or replacing parent dependencies, not just direct package bumps.

westfarn referenced this issue from a commit

2026-07-29 17:38:57 -07:00

Remediate llm-fe npm audit critical/high vulns (#53)

westfarn referenced a pull request that will close this issue

2026-07-29 17:39:04 -07:00

Remediate llm-fe npm audit critical/high vulnerabilities #69

westfarn closed this issue

2026-07-29 17:41:01 -07:00

westfarn referenced this issue from a commit

2026-07-29 17:41:03 -07:00

Remediate llm-fe npm audit critical/high vulnerabilities (#69)

Sign in to join this conversation.